How to Use Chainguard Containers on

How to Use Chainguard Containers

Thu, 01 Sep 2022 08:49:31 +0000

Chainguard Containers are minimal container images designed to reduce vulnerabilities and attack surface compared to traditional base images. These images use the apk package format to achieve smaller sizes while maintaining complete provenance information with cryptographic signatures, ensuring both enhanced security and traceability.

In this guide, you’ll find general instructions on how to get started using Chainguard Containers and how to migrate existing container-based workflows to use our images. For specific image usage instructions, please refer to our Chainguard Containers Directory, which contains the full list of all images available to the public and their respective documentation.

Using the Chainguard Console

Fri, 23 Feb 2024 11:07:52 +0200

This guide serves as a walkthrough of the Chainguard Console, which is accessible to anyone, but you’ll first need to create an account and log in.

If you’re not ready to create a Chainguard account, you can follow along with the public Chainguard Directory which offers similar information, but is only informative as it is not connected to your organization or account. If you use the Sign In link in the directory, it brings you to the console.

How to Use Chainguard Notifications

Fri, 11 Jul 2025 08:49:31 +0000

You can use the Chainguard Console to configure how Chainguard is permitted to send notifications about things like breaking changes to users in your organization. The feature includes options to allow notifications to be sent in-app to the Activity Center on the user’s Overview page in the Chainguard Console, via Slack, and for customers who are opted in, via email.

These notifications are different from Chainguard Events as Chainguard Notifications are sent by Chainguard’s customer success representatives.

Using the Chainguard Directory

Fri, 23 Feb 2024 11:07:52 +0200

There are hundreds of Chainguard Containers available for use. To help users explore and better understand all of these container images, we’ve developed the Chainguard Directory. This is a free to access web portal that does not require signing in from which you can view information about container images in the Chainguard catalog. This is great for quick searches or while exploring Chainguard’s offerings.

If you want more specific information about what is available to your organization, take a look at the Chainguard Console. You’ll first need to create an account and log in but there you can interact in a clearer, organization-specific way. If you use the Sign In link in the directory, it brings you to the console. Learn more about the Chainguard Console in the related docs page.

How to Use Chainguard Helm Charts

Fri, 11 Jul 2025 08:49:31 +0000

Helm is a package manager for Kubernetes that simplifies the installation and management of applications by automating the creation of Kubernetes resources. Helm charts are reusable, versioned packages that define a collection of Kubernetes resources required to run an application or service. You use Helm to define, install, and perform upgrades to your applications on Kubernetes.

For organizations looking to deploy their Chainguard container images with Helm, Chainguard provides upstream-produced Helm charts. These charts are available from the Chainguard Registry and are intended for customers who are either looking to get started with Helm or are looking for better, trusted alternatives to the public charts they may already be using.

How to Use Chainguard iamguarded Helm Charts

Fri, 11 Jul 2025 08:49:31 +0000

Chainguard offers this limited iamguarded set of Helm charts to go with a set of Chainguard-created containers labeled as iamguarded, designed specifically to support organizations migrating off of Bitnami. The iamguarded charts are forked from upstream Bitnami charts, but now configured out-of-the box for use with Chainguard’s hardened container images. These charts only receive edits necessary to make them work with Chainguard container images and retain the intended functionality of the originals they are based on. Because the iamguarded charts are forks, they may be susceptible to breaking changes introduced by the upstream. In such cases, customers should plan to transition to a community-provided alternative (or an equivalent one from Chainguard) where possible.

Proxy and cache Helm Charts with Artifactory

Mon, 14 Jul 2025 08:10:31 +0000

This page shows you how to set up and use Chainguard Helm Charts with Artifactory via remote Helm OCI repositories.

Create and configure Helm OCI repository in Artifactory

From the administration panel within Artifactory, create a remote repository, picking Helm as the repo type. we’ll call it iamguarded-charts

How to Use Chainguard Containers with OpenShift

Tue, 17 Jun 2025 08:49:31 +0000

Chainguard Containers are fully compatible with Red Hat OpenShift Container Platform, providing enhanced security while requiring some configuration adjustments for OpenShift’s security context constraints. This guide explains how to successfully deploy Chainguard’s minimal, security-hardened container images in OpenShift environments.

Red Hat OpenShift is an application platform that orchestrates and manages your systems and resources. While it is based on open source software like Kubernetes, OpenShift includes a suite of applications with additional functionality that are configured to work together.

Using Chainguard Containers in Dev Containers

Mon, 10 Mar 2025 11:07:52 +0200

Development Containers — sometimes known as “dev containers” — allow you to use a container as a development environment where you can run applications and separate tools, libraries, or runtimes. Dev containers can also help with testing and continuous integration.

With a few changes, the images based on Wolfi and maintained by Chainguard provide distroless images that can be used as dev containers. This guide outlines how you can set up a Chainguard image as a dev container in VS Code.

Using Init Containers with Chainguard Containers

Mon, 04 Aug 2025 15:21:01 +0000

Chainguard Containers are designed with minimalism and security in mind. By including fewer packages and tools, Chainguard Containers have a smaller attack surface than their counterparts. However, there are cases where the external counterparts have certain desirable features, like useful startup scripts or configuration defaults.

There are several ways to customize Chainguard Containers. For example, you can use Custom Assembly to add packages to an otherwise minimal Chainguard container image. Changing a Chainguard container image’s configuration — such as updating its entrypoint or adding startup scripts — requires a different strategy. One method for doing so in Kubernetes deployments is to use init containers.

Using the Chainguard Static Base Container Image

Wed, 30 Aug 2023 15:21:01 +0000

Tools used in this video

Docker
Grype

Dockerfile

FROM cgr.dev/chainguard/go AS build
COPY main.go /main.go
RUN CGO_ENABLED=0 go build -o /hello /main.go
FROM cgr.dev/chainguard/static
COPY --from=build /hello /usr/local/bin/
CMD ["hello"]

Transcript

So what’s the best container base image to use?

How to Use Container Image Digests to Improve Reproducibility

Mon, 07 Aug 2023 15:21:01 +0200

Tools used in this video

Docker
Crane

Commands used

docker pull cgr.dev/chainguard/node

docker manifest inspect cgr.dev/chainguard/node@sha256:ede7ef4ca485553f5313f7a02ad3537db1fe337079fc7cfb879f44cf709326db

crane digest --full-ref cgr.dev/chainguard/node

docker pull cgr.dev/chainguard/node:latest@sha256:ede7ef4ca485553f5313f7a02ad3537db1fe337079fc7cfb879f44cf709326db

Dockerfile

FROM cgr.dev/chainguard/go:latest@sha256:7e60584b9ae1eec6ddc6bc72161f4712bcca066d5b1f511d740bcc0f65b05949 AS build
WORKDIR /src
RUN CGO_ENABLED=0 go build -o /bin/server ./src
FROM cgr.dev/chainguard/static AS prod
COPY --from=build /bin/server /bin/
EXPOSE 8000
ENTRYPOINT [ "/bin/server" ]

Transcript

0:05 You might have heard the advice to pin to a digest when using container images.

Reproducible Dockerfiles with Frizbee and Digestabot

Fri, 07 Jun 2024 12:21:01 +0000

Tools

Transcript

I’d like to talk about a problem I faced with container builds in the past and a potential solution.

Getting Software Versions from Chainguard Containers

Fri, 07 Jul 2023 15:21:01 +0200

Tools used in this video

Commands used

cosign download attestation --platform=linux/amd64 \
--predicate-type=https://spdx.dev/Document \
cgr.dev/chainguard/python:latest | jq -r .payload | base64 -d \
| jq -r '.predicate.packages[] | "\(.name) \(.versionInfo)"'

docker run cgr.dev/chainguard/wolfi-base ls /var/lib/db/sbom

Transcript

Hi, I want to record a very short video on how to get software version information out of Chainguard Containers.

Building Minimal Container Images for Applications with Runtimes

Wed, 06 Sep 2023 01:21:01 +0000

Tools used in this video

Docker

Resources

The Dockerfiles used in this video and other supporting documentation are available on GitHub.

Installing APK packages in distroless variants

Tue, 21 Apr 2026 00:00:01 +0000

This page documents workflows for installing APK packages in distroless variants of Chainguard container images, such as most builds tagged :latest. We copy a filesystem from a distroless container image to a build image, install APKs to it using chroot, then copy the modified filesystem back to the distroless image in the final step.

Overview: Installing packages in distroless containers

The distroless variants of Chainguard Containers do not contain shells or package managers by design. This reduces attack surface and exploitability for these images. In cases where additional packages are required, we typically recommend the following:

Verifying Chainguard Containers and Metadata Signatures with Cosign

Mon, 18 Mar 2024 08:59:52 -0700

Chainguard signs all container images and their attestations (including SBOMs) to ensure supply chain security and enable verification of image authenticity. These cryptographic signatures allow you to confirm that images come from Chainguard and haven’t been tampered with, while attestations provide detailed information about image contents and build provenance.

This guide outlines how you can use Cosign to download and verify container image signatures and attestations.

Prerequisites

The following examples require Cosign and jq to be installed on your machine in order to download and verify image attestations.

How to Retrieve SBOMs and attestations for Chainguard Containers

Fri, 17 Nov 2023 11:07:52 +0200

Chainguard provides a Software Bill of Materials (SBOM) with every container image, enabling complete transparency about package contents and dependencies for security and compliance requirements. These SBOMs are cryptographically signed and attached as attestations, making them retrievable and verifiable. By including only the minimum packages needed, Chainguard Containers reduce attack surface while the SBOM ensures you can verify exactly what’s in each image.

Even though they contain the minimum number of packages, there may come a time when you want to know exactly what’s running inside of a certain Chainguard Container. For this reason, Chainguard includes a signed SBOM with each image in the form of a software attestation, allowing you to verify the contents and meet compliance requirements. Chainguard publishes several different types of attestations; see the options under the Available attestation types section on this page.